Skip to content
Noroxi

tonghuaroot

36 credited records · 35 in the last 12 months · 0 in CISA KEV

Names are free text from CNA records; the same person may appear under different spellings. Write to us for corrections.

Get told when this name is credited on a new CVE

If it's you, this is the easiest way to track your records: we'll notify you in the daily email digest when a new one is published.

Follow new records for tonghuaroot

When you'll hear from us

  • when this name is credited on a new CVE record

One daily email digest (06:00 UTC); connect a webhook for KEV listings and weaponized exploits every 10 minutes on paid plans, on the hour on the free plan.

Your free account also gets you

Running WordPress? Scan your site free with WP Lens

  • Stack alerts: add the products and versions you run, get the new CVEs that affect them
  • Uptime monitoring: 1 site, instant email when it goes down
  • Add your domain: subdomains and takeover risk scanned every week (1 domain)
  • 10 scans an hour on the security tools, at most 30 a day (3 a day without an account), an API key and MCP
  • All your scans in one panel: findings, what changed in the last scan, a report per domain or per client (PDF, share link)
All free tools

Sign up with email · Have an account? Sign in

Free account, no card. Unfollow any time.

Don't want an account? Get "Exploited this week" by email every Monday

Credited records

Researchers
  • CVE-2026-124452
    20Monitor

    OpenEMR before 8.3.0 Stored XSS via Eye Exam Document Notes

    MediumCVSS 5.1No exploitEPSS 0%

    openemr · openemr3 days ago

  • CVE-2026-121420
    19Monitor

    SurrealDB 3.2.0 before 3.3.0 SSRF Guard Bypass via IPv6 Transition Addresses

    MediumCVSS 4.8No exploitEPSS 0%

    surrealdb · surrealdbNov 3, 2026

  • CVE-2026-116179
    34Monitor

    vLLM 0.18.0 before 0.31.0 Memory Exhaustion via media_io_kwargs num_frames Override

    HighCVSS 8.7No exploitEPSS 0%

    vllm · vllmOct 25, 2026

  • CVE-2026-59562
    39Monitor

    Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe sendFile RPC

    CriticalCVSS 9.8No exploitEPSS 0%

    apache software foundation · apache iotdbOct 21, 2026

  • CVE-2026-110712
    28Monitor

    libsmb2 through 6.2 Heap Out-of-Bounds Read via smb2_decode_file_all_info

    HighCVSS 7.1No exploitEPSS 0%

    sahlberg · libsmb2Oct 14, 2026

  • CVE-2026-108109
    37Monitor

    PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Code

    CriticalCVSS 9.3No exploitEPSS 0%

    hotspotbilling · phpnuxbillOct 9, 2026

  • CVE-2026-66082
    26Monitor

    Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow）

    MediumCVSS 6.5No exploitEPSS 0%

    apache software foundation · apache dolphinschedulerOct 8, 2026

  • CVE-2026-105163
    27Monitor

    crossplane crossplane-runtime ImageConfig client.go Get toctou

    MediumCVSS 6.9No exploitEPSS 0%

    crossplane · crossplane-runtimeOct 4, 2026

  • CVE-2026-104458
    33Monitor

    YesWiki before 4.6.7 SSRF Guard Bypass via IPv6 Transition Addresses

    HighCVSS 8.3No exploitEPSS 0%

    yeswiki · yeswikiOct 2, 2026

  • CVE-2026-57590
    32Monitor

    Apache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations

    HighCVSS 8.1No exploitEPSS 0%

    apache software foundation · apache dolphinschedulerSep 24, 2026

  • CVE-2026-94301
    39Monitor

    Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232

    CriticalCVSS 9.8No exploitEPSS 0%

    apache software foundation · apache minaSep 21, 2026

  • CVE-2026-93597
    21Monitor

    ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses

    MediumCVSS 5.3No exploitEPSS 0%

    arcadedata · arcadedbSep 18, 2026

  • CVE-2026-93426
    33Monitor

    SigNoz 0.87.0 before 0.142.0 - SQL Injection in v5 Query Builder Field Key Names

    HighCVSS 8.4No exploitEPSS 0%

    signoz · signozSep 17, 2026

  • CVE-2026-86735
    23Monitor

    snipe-it before 8.7.0 SSRF via IPv6 transition address bypass

    MediumCVSS 5.9No exploitEPSS 0%

    snipeitapp · snipe-itSep 8, 2026

  • CVE-2026-49329
    30Monitor

    Openshift/oauth-server: openshift/oauth-server: quadratic-time dos via accept-language header underscore bypass on unauthenticated login endpoints

    HighCVSS 7.5No exploitEPSS 0%

    red hat · red hat openshift container platform 4Sep 1, 2026

  • CVE-2026-63041
    21Monitor

    Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers

    MediumCVSS 5.3No exploitEPSS 0%

    apache · apisixAug 26, 2026

  • CVE-2026-79658
    34Monitor

    Ech0 before 5.0.1 Denial of Service via Accept-Language

    HighCVSS 8.7No exploitEPSS 0%

    lin-snow · ech0Aug 25, 2026

  • CVE-2026-76838
    33Monitor

    Hi.Events before 1.11.1-beta Server-Side Request Forgery via Unvalidated Webhook Redirects

    HighCVSS 8.4No exploitEPSS 0%

    hieventsdev · hi.eventsAug 24, 2026

  • CVE-2026-74866
    23Monitor

    @fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name

    MediumCVSS 5.8No exploitEPSS 0%

    fastify · fastify/busyboyAug 21, 2026

  • CVE-2026-63042
    32Monitor

    Apache InLong: Missing authorization on DataNode management endpoints

    HighCVSS 8.1No exploitEPSS 0%

    apache · inlongAug 20, 2026

  • CVE-2026-58436
    30Monitor

    ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

    HighCVSS 7.5No exploitEPSS 0%

    gitea · gitea open source git serverAug 13, 2026

  • CVE-2026-72761
    27Monitor

    Webhook SSRF guard bypassed by IPv6 transition addresses (NAT64/6to4/Teredo pass is_global check) in vulnerability-lookup

    MediumCVSS 6.9No exploitEPSS 0%

    vulnerability-lookup · vulnerability-lookupAug 10, 2026

  • CVE-2026-50749
    26Monitor

    Apache Answer: Missing authorization in revision audit reject allows authenticated users to reject pending revisions

    MediumCVSS 6.5No exploitEPSS 0%

    apache · answerAug 5, 2026

  • CVE-2026-48912
    26Monitor

    Apache Answer: Improper authorization in avatar update cleanup allows authenticated users to delete arbitrary uploaded files by URL

    MediumCVSS 6.5No exploitEPSS 0%

    apache · answerAug 5, 2026

  • CVE-2026-48911
    30Monitor

    Apache Answer: Unauthenticated OAuth Email-Binding Account Takeover via Existing User Confirmation Flow

    HighCVSS 7.5No exploitEPSS 0%

    apache · answerAug 5, 2026